File: //lib/python3.9/site-packages/jwcrypto/__pycache__/jws.cpython-39.pyc
a
#,�e^k � @ sJ d dl mZmZ d dl mZmZ d dl mZmZ d dl mZmZ d dl m
Z
d dl m Z m
Z
eddd d
�ed ddd
�ed ddd
�ed
dd d
�edddd
�edddd
�edddd
�edddd
�eddd d
�eddd d
�edd d d
�edd d d
�d� Zg d�ZG dd� de�ZG dd� de�ZG d d � d e�ZG d d � d �ZG d d!� d!�Zd
S )"� )� JWException�
JWKeyNotFound)�JWSEHeaderParameter�JWSEHeaderRegistry)�base64url_decode�base64url_encode)� json_decode� json_encode)�JWA)�JWK�JWKSetZ AlgorithmFTNz JWK Set URLz JSON Web KeyzKey IDz X.509 URLzX.509 Certificate Chainz"X.509 Certificate SHA-1 Thumbprintz$X.509 Certificate SHA-256 Thumbprint�Typez Content TypeZCriticalzBase64url-Encode Payload) �algZjkuZjwk�kidZx5uZx5cZx5tzx5t#S256�typZcty�crit�b64)ZHS256ZHS384ZHS512ZRS256ZRS384ZRS512ZES256ZES384ZES512ZPS256ZPS384ZPS512ZEdDSAZES256Kc s" e Zd ZdZd� fdd� Z� ZS )�InvalidJWSSignaturez_Invalid JWS Signature.
This exception is raised when a signature cannot be validated.
Nc s> d }|rt |�}nd}|r*|dt |� 7 }tt| ��|� d S )Nz&Unknown Signature Verification Failure� {%s})�str�superr �__init__��self�message� exception�msg�� __class__� �0/usr/lib/python3.9/site-packages/jwcrypto/jws.pyr + s
z InvalidJWSSignature.__init__)NN��__name__�
__module__� __qualname__�__doc__r �
__classcell__r r r r r % s r c s" e Zd ZdZd� fdd� Z� ZS )�InvalidJWSObjectzvInvalid JWS Object.
This exception is raised when the JWS Object is invalid and/or
improperly formatted.
Nc s< d}|r|d| 7 }|r(|dt |� 7 }tt| ��|� d S )NzInvalid JWS Objectz [%s]r )r r r' r r r r r r = s zInvalidJWSObject.__init__)NNr! r r r r r' 6 s r' c s" e Zd ZdZd� fdd� Z� ZS )�InvalidJWSOperationz�Invalid JWS Object.
This exception is raised when a requested operation cannot
be execute due to unsatisfied conditions.
Nc s: d }|r|}nd}|r&|dt |� 7 }tt| ��|� d S )NzUnknown Operation Failurer )r r r( r r r r r r M s z InvalidJWSOperation.__init__)NNr! r r r r r( F s r( c @ s: e Zd ZdZd
dd�Zdd� Zdd� Zd d
� Zd d � ZdS )�JWSCorez�The inner JWS Core object.
This object SHOULD NOT be used directly, the JWS object should be
used instead as JWS perform necessary checks on the validity of
the object and requested operations.
Nc C sl || _ | �||�| _|| _|durPt|t�r4t|�}t|�| _t |�
d��| _ n i | _d| _ | � |�| _
dS )a Core JWS token handling.
:param alg: The algorithm used to produce the signature.
See RFC 7518
:param key: A (:class:`jwcrypto.jwk.JWK`) verification or
a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed by the
'kid' header. A JWKSet is allowed only for verification operations.
:param header: A JSON string representing the protected header.
:param payload(bytes): An arbitrary value
:param algs: An optional list of allowed algorithms
:raises ValueError: if the key is not a (:class:`jwcrypto.jwk.JWK`)
:raises InvalidJWAAlgorithm: if the algorithm is not valid, is
unknown or otherwise not yet implemented.
:raises InvalidJWSOperation: if the algorithm is not allowed.
N�utf-8� )r �_jwa�engine�key�
isinstance�dictr r �headerr �encode� protected�_payload�payload)r r r. r1 r5 �algsr r r r a s
zJWSCore.__init__c C s& |d u r t }||vr td��t�|�S )NzAlgorithm not allowed)�default_allowed_algsr( r
Z signing_alg)r �name�allowedr r r r, � s
z JWSCore._jwac C s8 | j �dd�r t|��d�S t|t�r*|S |�d�S d S )Nr Tr* )r1 �getr r2 r/ �bytes�r r5 r r r r4 � s
zJWSCore._payloadc C sP t | jt�std��d�| j�d�| jg�}| j� | j|�}| j| jt
|�d�S )zGenerates a signaturezkey is not a JWK object� .r* )r3 r5 � signature) r/ r. r �
ValueError�joinr3 r2 r5 r- �signr )r �siginr> r r r rA � s ��z JWSCore.signc
C sb z.d� | j�d�| jg�}| j�| j||� W n. ty\ } ztd�|�W Y d}~n
d}~0 0 dS )z�Verifies a signature
:raises InvalidJWSSignature: if the verification fails.
:return: Returns True or an Exception
:rtype: `bool`
r= r* zVerification failedNT) r@ r3 r2 r5 r- �verifyr. � Exceptionr )r r> rB �er r r rC � s � zJWSCore.verify)N) r" r# r$ r% r r, r4 rA rC r r r r r) X s
! r) c @ s� e Zd ZdZd+dd�Zedd� �Zejdd� �Zedd � �Zd
d � Z d,d d
�Z
dd� Z d-dd�Z dd� Z
dd� Zd.dd�Zd/dd�Zd0dd �Zed d � �Zd d � Zed!d"� �Zed#d$� �Zd%d&� Zd'd(� Zd)d*� ZdS )1�JWSzFJSON Web Signature object
This object represent a JWS token.
Nc C s: i | _ || j d< d| _d| _tt�| _|r6| j�|� dS )z�Creates a JWS object.
:param payload(bytes): An arbitrary value (optional).
:param header_registry: Optional additions to the header registry
r5 N)�objects� verifylog�
_allowed_algsr �JWSHeaderRegistry�header_registry�update)r r5 rK r r r r � s
z JWS.__init__c C s | j r | j S tS dS )z�Allowed algorithms.
The list of allowed algorithms.
Can be changed by setting a list of algorithm names.
N)rI r7 �r r r r � allowed_algs� s zJWS.allowed_algsc C s t |t�std��|| _d S )NzAllowed Algs must be a list)r/ �list� TypeErrorrI )r r6 r r r rN � s
c C s | j �dd�S )N�validF)rG r: rM r r r �is_valid� s z JWS.is_validc G s d }g }|d ur|d|v rZ|d }|D ]4}|| j vr@td| ��q$| j | js$td| ��q$|}d|v r|t|d t�s|td��|D ]l}|d u r�q�|d u r�i }t|�� �D ]:}|| j v r�| j | jr�td| ��||v r�td| ��q�|�|� q�|D ]}||vr�td| ��q�|S ) Nr z Unknown critical header: "%s"z!Unsupported critical header: "%s"r z b64 header must be a booleanz"%s" must be protectedzDuplicate header: "%s"z Missing critical header "%s") rK r' Z supportedr/ �boolrO �keysZ mustprotectrL )r r3 Zheadersr1 r �kZhn�hr r r �_merge_check_headers� sD
� �
zJWS._merge_check_headersc C s� i }|d ur&t |�}t|t�s&td��|r<t|t�s<td��| �||�}|D ]$} | | jv rL| j�| | �sLtd��qL|d u r�d|vr�td��|r�d|v r�||d kr�td|� d|d � d���|}
n|d }
t|t�r�t|
|||| j �} | �
|� | j � d � n�t|t
��r�|} d
| jv �rH|�| jd
�}
|
�sDtd �| jd
���|
} | D ]�}z4t|
|||| j �}|�
|� | j � d � W �q�W nN t�y� } z4|�d
|�� �}| j � d �|t|��� W Y d }~n
d }~0 0 �qLd | j v�r�td
��ntd��d S )NzInvalid Protected headerzInvalid Unprotected headerzFailed header checkr zNo "alg" in headersz"alg" mismatch, requested "z
", found "�"ZSuccessr zKey ID {} not in key setzKey [{}] failed: [{}]� No working key found in key setzUnrecognized key type)r r/ r0 r rW rK Z check_headerr r) rI rC rH �appendr � jose_headerZget_keysr �formatrD r: Z
thumbprint�reprr? )r r r. r5 r> r3 r1 �pZchk_hdrsZhdrZ
resulting_algZsignerrT Zkid_keysrU Zsigner2rE Zkeyidr r r �_verify st
���
�
��
�
z JWS._verifyc C s6 |� d�}|d ur2|d u s&t|�dkr*|S td��|S )Nr5 r z4Object Payload present but Detached Payload provided)r: �lenr( )r �objZdp�opr r r �_get_obj_payloadE s
zJWS._get_obj_payloadc C s� g | _ d| jd< | j}d}d|v r�| �||�}z4| �||||d |�dd�|�dd�� d|d< W nF ty� } z.t|t�r�d}| j �dt |� � W Y d}~n
d}~0 0 n�d |v �rR| �||�}|d D ]�}z4| �||||d |�dd�|�dd�� d|d< W q� t�yL } z0t|t��r$d}| j �dt |� � W Y d}~q�d}~0 0 q�nt
d
��| j �s�|�rptd ��t
d t | j � ��dS )
a
Verifies a JWS token.
:param key: A (:class:`jwcrypto.jwk.JWK`) verification or
a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed by the
'kid' header.
:param alg: The signing algorithm (optional). Usually the algorithm
is known as it is provided with the JOSE Headers of the token.
:param detached_payload: A detached payload to verify the signature
against. Only valid for tokens that are not carrying a payload.
:raises InvalidJWSSignature: if the verification fails.
:raises InvalidJWSOperation: if a detached_payload is provided but
an object payload exists
:raises JWKeyNotFound: if key is a JWKSet and the key is not found.
FrQ r> r3 Nr1 Tz Failed: [%s]�
signatureszNo signatures availablerY z&Verification failed for all signatures) rH rG rc r_ r: rD r/ r rZ r] r rR ) r r. r Zdetached_payloadra Z
missingkeyr5 rE �or r r rC O sP
�
,
� .�z
JWS.verifyc C sR dt t|d ��i}d|v r:t t|d ��}|�d�|d< d|v rN|d |d< |S )Nr> r3 r* r1 )r r �decode)r �sre r^ r r r �_deserialize_signature� s zJWS._deserialize_signaturec C sn |d u rd }n,t |�}|�d�}|d ur:t|t�s:td��|�d�}||krPd S |d u rb||d< ntd��d S )Nr zb64 header must be booleanzconflicting b64 values)r r: r/ rS r' )r re r3 Zb64nr^ r r r r �_deserialize_b64� s
zJWS._deserialize_b64c
C s� i | _ i }�zLz�t|�}d|v rbg |d< |d D ].}| �|�}|d �|� | �||�d�� q0n | �|�}| �||�d�� d|v r�|�dd�r�tt|d ��|d< n |d |d< W n� t�yN |� d�}t
|�dkr�t d�d �tt|d
��} t
| �d
k�r"| � d �|d< | �||d � tt|d ��|d< tt|d
��|d< Y n0 || _ W n0 t
�y� }
zt d�|
�W Y d }
~
n
d }
~
0 0 |�r�| �||� d S )aw Deserialize a JWS token.
NOTE: Destroys any current status and tries to import the raw
JWS provided.
If a key is provided a verification step will be attempted after
the object is successfully deserialized.
:param raw_jws: a 'raw' JWS token (JSON Encoded or Compact
notation) string.
:param key: A (:class:`jwcrypto.jwk.JWK`) verification or
a (:class:`jwcrypto.jwk.JWKSet`) that contains a key indexed by the
'kid' header (optional).
:param alg: The signing algorithm (optional). Usually the algorithm
is known as it is provided with the JOSE Headers of the token.
:raises InvalidJWSObject: if the raw object is an invalid JWS token.
:raises InvalidJWSSignature: if the verification fails.
:raises JWKeyNotFound: if key is a JWKSet and the key is not found.
rd r3 r5 r T�.� zUnrecognized representationNr r* � � r> zInvalid format)rG r rh rZ ri r: r r r? �splitr` r' rf rD rC ) r Zraw_jwsr. r re Zdjwsrg �os�datar^ rE r r r � deserialize� sD
�
zJWS.deserializec
C s d}|r$t |t�rt|�}t|�}nt� }dt|�� �v r^|�dg �}d|vrVtd��|d }d| jv r~|| jd kr~td��d}|r�t |t�r�t|�}t|�}| � ||�}d|v r�|du r�|d }n||d kr�t
d��|du r�t
d ��t |||| j�d
�| j �} | �
� }
t|
d �dd �} |�r,|| d
< |�r:|| d< d| jv �rX| jd �| � n�d | jv �r�g | jd< d | j�d �i} d
| jv �r�| j�d
�| d
< d| jv �r�| j�d�| d< d| jv �r�| j�d�| d< | jd �| � | jd �| � n| j�| � || jd< dS )a Adds a new signature to the object.
:param key: A (:class:`jwcrypto.jwk.JWK`) key of appropriate for
the "alg" provided.
:param alg: An optional algorithm name. If already provided as an
element of the protected or unprotected header it can be safely
omitted.
:param protected: The Protected Header (optional)
:param header: The Unprotected Header (optional)
:raises InvalidJWSObject: if invalid headers are provided.
:raises ValueError: if the key is not a (:class:`jwcrypto.jwk.JWK`)
:raises ValueError: if the algorithm is missing or is not provided
by one of the headers.
:raises InvalidJWAAlgorithm: if the algorithm is not valid, is
unknown or otherwise not yet implemented.
Tr r z"b64 header must always be criticalz Mixed b64 headers on signaturesNr zF"alg" value mismatch, specified "alg" does not match JOSE header valuez"alg" not specifiedr5 r> )r> rQ r3 r1 rd rQ )r/ r0 r r rO rT r: r' rG rW r? r) rN rA r rZ �poprL )
r r. r r3 r1 r r^ r rV �c�sigre �nr r r �
add_signature� sl
�
�
zJWS.add_signatureFc C sX |�rd| j v rtd��d| j vr*td��| j �dd�s@td��d| j v rxt| j d �}d |vrhtd
��t| j d �}ntd ��| j �d �r�| j �d
d�r�t| j d �}q�t| j d t�r�| j d �d�}n
| j d }d|v r�td��nd}d� ||t| j d �g�S | j }i }| j �d d�}| j �d
d��r<t|�|d < n||d < d|v �r�|�dd��sdtd��t|d �|d< d|v �r�t|d �|d< d|v �rL|d |d< n�d|v �rDg |d< |d D ]f}|�dd��sq�dt|d �i}d|v �r t|d �|d< d|v �r|d |d< |d �
|� �q�t |d �dk�rLtd��ntd��t |�S dS )a Serializes the object into a JWS token.
:param compact(boolean): if True generates the compact
representation, otherwise generates a standard JSON format.
:raises InvalidJWSOperation: if the object cannot serialized
with the compact representation and `compact` is True.
:raises InvalidJWSSignature: if no signature has been added
to the object, or no valid signature can be found.
:return: A json formatted string or a compact representation string
:rtype: `str`
rd z3Can't use compact encoding with multiple signaturesr> zNo available signaturerQ FzNo valid signature foundr3 r z5Compact encoding must carry 'alg' in protected headerz3Can't use compact encoding without protected headerr5 r Tr* rj zKCan't use compact encoding with unencoded payload that uses the . characterr+ r1 r N)
rG r( r r: r r r/ r; rf r@ rZ r` r ) r Zcompactr^ r3 r5 ra rt re rg r r r � serialize= sp
� �
z
JWS.serializec C s | j std��| j�d�S )NzPayload not verifiedr5 )rR r( rG r: rM r r r r5 � s z JWS.payloadc C s | j �dd � d S )Nr5 )rG rr rM r r r �detach_payload� s zJWS.detach_payloadc C s� | j }d|v r<d|v r$t|d �}nd }| �||�di ��S d| j v r�g }|d D ]@}i }d|v rpt|d �}nd }| �||�di ��}|�|� qR|S td��d S )Nr> r3 r1 rd z JOSE Header(s) not available)rG r rW r: rZ r( )r ra r^ Zjhlre Zjhr r r r[ � s"
zJWS.jose_headerc C s | � }|� |� |S )a Creates a JWS object from a serialized JWS token.
:param token: A string with the json or compat representation
of the token.
:raises InvalidJWSObject: if the raw object is an invalid JWS token.
:return: A JWS token
:rtype: JWS
)rq )�cls�tokenra r r r �from_jose_token� s
zJWS.from_jose_tokenc C sD t |t�sdS z| �� |�� kW S ty> | j|jk Y S 0 d S )NF)r/ rF rw rD rG )r �otherr r r �__eq__� s
z
JWS.__eq__c C s* z
| � � W S ty$ | �� Y S 0 d S )N)rw rD �__repr__rM r r r �__str__� s
z JWS.__str__c C sF zd| � � � d�W S ty@ | jd �d�}d|� d� Y S 0 d S )NzJWS.from_json_token("z")r5 r* z JWS(payload=�))rw rD rG rf r< r r r r~ � s
z JWS.__repr__)NN)N)NN)NN)NNN)F)r" r# r$ r% r �propertyrN �setterrR rW r_ rc rC rh ri rq rv rw r5 rx r[ � classmethodr{ r} r r~ r r r r rF � s6
'
C
;
>
[
P
rF )Zjwcrypto.commonr r r r r r r r Z jwcrypto.jwar
Z jwcrypto.jwkr r rJ r7 r r' r( r) rF r r r r �<module> s8 �� � V